Greetings, many thanks for getting in touch with this question. That is indeed what the source-root option will do, and it is almost certainly not the option you want to be using. Is your goal to only scan files in the packages/react folder? If so, I would recommend using the paths property of the configuration file as documented here.

In particular, you'll want to make a file called ./.github/codeql/codeql-config.yml (or add to your exist one if you already have it) that contains:

paths:
  - packages/react

Then, in your init step do:

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ inputs.languages }}
        config-file: ./.github/codeql/codeql-config.yml

I hope that's helpful! Do let me know if that works for you or if you have any further questions.

Thank you @edoardopirovano. This makes sense.
I was hoping to be able to pass the paths to scan as an input to the init action, as I have multiple folders that I wanted to scan individually with a different category. As a workaround I am now writing the config file in the action to output the path based on the inputs.working-directory I am passing.

Aha, I see. That is an interesting use case that we don't have an easy path for. Your workaround sounds reasonable, and is what I would've suggested too. We'll certainly keep your scenario in mind if we ever do a major reshuffle of how these parameters are configured!

cc. @aeisenberg as the above is likely to be of interest to you.

Thanks for the issue. I think the feature you want is to be able to pass the paths and paths-ignore config options as action inputs. This is straightforward enough to do. It's not on our roadmap right now and if we get any more requests for a feature like this, we will consider it. Though, it sounds like you have a reasonable workaround.